[Mlir-commits] [mlir] WIP: [mlir][func] Fix potential crash in `FuncOp::verify` (PR #184607)

[Ingo Müller]

https://github.com/ingomueller-net created https://github.com/llvm/llvm-project/pull/184607

This PR fixes a potential crash in `FuncOp::verify`. This can happen if one of the operands of the return op inside the verified op is a `<<NULL>>` value, for example, because the original value had all uses dropped. The original implementation used the operands without checking their validity, which could lead to a crash. The fix consists in adding a test and failing verificiation if not all operands exist.

>From 3f18453b084c8ecabe682eaed4deddf8e5fc3177 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ingo=20M=C3=BCller?= <ingomueller at google.com>
Date: Wed, 4 Mar 2026 13:21:51 +0000
Subject: [PATCH] WIP: [mlir][func] Fix potential crash in `FuncOp::verify`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR fixes a potential crash in `FuncOp::verify`. This can happen if
one of the operands of the return op inside the verified op is a
`<<NULL>>` value, for example, because the original value had all uses
dropped. The original implementation used the operands without checking
their validity, which could lead to a crash. The fix consists in adding
a test and failing verificiation if not all operands exist.

Signed-off-by: Ingo Müller <ingomueller at google.com>
---
 mlir/lib/Dialect/Func/IR/FuncOps.cpp | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/mlir/lib/Dialect/Func/IR/FuncOps.cpp b/mlir/lib/Dialect/Func/IR/FuncOps.cpp
index 8ee2c9956d2d6..7c4c5a593d5fd 100644
--- a/mlir/lib/Dialect/Func/IR/FuncOps.cpp
+++ b/mlir/lib/Dialect/Func/IR/FuncOps.cpp
@@ -305,9 +305,12 @@ LogicalResult FuncOp::verify() {
              << " operands, but enclosing function (@" << getName()
              << ") returns " << resultTypes.size();
 
-    for (auto [i, opType] :
-         llvm::enumerate(llvm::zip(returnOp->getOperandTypes(), resultTypes))) {
-      auto [opTy, resTy] = opType;
+    for (auto [i, operand] :
+         llvm::enumerate(llvm::zip(returnOp->getOpOperands(), resultTypes))) {
+      auto [opOperand, resTy] = operand;
+      if (!opOperand.get())
+        return returnOp->emitOpError("null operand at index ") << i;
+      auto opTy = opOperand.get().getType();
       if (opTy != resTy)
         return returnOp->emitError()
                << "type of return operand " << i << " (" << opTy